Bug 2484830 (CVE-2026-41178)
| Summary: | CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, abarbaro, abuckta, akoudelk, alebedev, alizardo, amctagga, anjoseph, anpicker, aoconnor, aruklets, asatyam, bniver, ckandaga, cmah, crizzo, dakwon, dhanak, diagrawa, dkeler, dkuc, doconnor, drosa, dsimansk, dymurray, eaguilar, ebaron, eborisov, eglynn, eshamard, flucifre, gbenhaim, gmeno, gparvin, groman, hasun, ibolton, jcantril, jchui, jdobes, jfula, jhe, jjoyce, jmatsuok, jmatthew, jmontleo, jowilson, jprabhak, jpretori, jschluet, jtolenti, jvasik, kaycoth, kingland, ktsao, lball, lbragsta, lchilton, lgamliel, lhh, mbenjamin, mburns, mgarciac, mhackett, mnovotny, mstipich, mwringe, nboldt, ngough, niyer, nyancey, oaljalju, ometelka, orabin, pgaikwad, pjindal, psrna, ptisnovs, pvasanth, rblanco, rekumar, rexwhite, rhaigner, rhel-process-autobot, rjohnson, rojacob, sabiswas, sakbas, sausingh, sbratsla, sdawley, sfeifer, slucidi, sostapov, sseago, sthirugn, suppawar, syedriko, thason, twaugh, tzivkovi, vereddy, veshanka, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2515044, 2515045, 2515046, 2515047, 2515049, 2515050, 2515051, 2515052, 2515053, 2515054, 2515055, 2515058, 2515059, 2515060, 2515062, 2515063, 2515064, 2515065, 2515068, 2515069, 2515070, 2515071, 2515072, 2515073, 2515074, 2515076, 2515077, 2515078, 2515079, 2515080, 2515081, 2515082, 2515083, 2515084, 2515085, 2515086, 2515087, 2515088, 2515089, 2515090, 2515091, 2515092, 2515093, 2515094, 2515095, 2515096, 2515097, 2515100, 2515101, 2515102, 2515103, 2515104, 2515105, 2515106, 2515107, 2515108, 2515110, 2515111, 2515115, 2515116, 2515117, 2515118, 2515119, 2515120, 2515121, 2515123, 2515124, 2515125, 2515126, 2515127, 2515128, 2515129, 2515130, 2515132, 2515133, 2515135, 2515136, 2515137, 2515138, 2515139, 2515142, 2515143, 2515144, 2515145, 2515048, 2515057, 2515061, 2515066, 2515067, 2515075, 2515098, 2515099, 2515109, 2515112, 2515113, 2515114, 2515122, 2515131, 2515134, 2515140, 2517703 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-06-04 16:01:33 UTC
|